Internal Control Design and Segregation of Duties
Internal control sets the boundaries within which fraud is possible. CFBE tests control design at the level of who can do what to which record, and segregation of duties at the level of which duty combinations create an opportunity that no single control will catch.
COSO and the control vocabulary
COSO's 2013 framework has five components - control environment, risk assessment, control activities, information and communication, and monitoring - expressed as 17 principles. Control activities are preventive (approval, access restriction, dual custody) or detective (reconciliation, exception report, surprise count). Every financial statement audit must treat management override of controls as a fraud risk under AU-C 240 and ISA 240, and must test journal entries.
The four incompatible functions
Authorisation, custody, record keeping, and reconciliation. One person holding two of these over the same asset creates opportunity:
- Custody plus record keeping - theft concealed in the books.
- Authorisation plus custody - self-approved disbursement.
- Record keeping plus reconciliation - the reconciliation cannot detect the recorder's own error or fraud.
In IT the parallel split is security administration, application development, change management, and production operations.
Worked example
A mid-sized company has one AP clerk who adds new vendors to the master file, enters invoices, and prints checks. A separate manager signs the checks. Is the control adequate?
Reasoning: no. The clerk can create a fictitious vendor, enter an invoice, and print a check; the signing manager sees a properly formatted check payable to an unfamiliar name but holds no independent vendor list. The signature is not a compensating control because it does not verify vendor existence. Realistic mitigation: vendor master changes require a second approver outside AP, a monthly report of new vendors and bank-detail changes goes to the controller, and payments are matched three ways (purchase order, receipt, invoice) before release.
Traps
- Calling any second signature a compensating control; compensation requires independent detection capability.
- Confusing IT general controls such as access, change, and backup with business-process controls.
- Overlooking mandatory vacation and job rotation as detective controls against concealment schemes.
- Assuming small entities must accept a SOD failure; they substitute owner-manager review, but the owner must actually review and the review must be evidenced.
- Forgetting that management override is presumed in every audit.